Privacy Policy

Template text, to be reviewed by a lawyer before launch. Last updated 5 November 2026.

Who we are

[Company legal name], [Registered address] ("we") operates Annotiv. Contact: hello@annotiv.example.

Researchers (account holders)

We store your name, email, organisation and sign-in details to run your account, and the projects you create. Sign-in is handled by Google Firebase Authentication.

Fraud and abuse prevention

To protect free training time from abuse, when you create an account and when you start a model training job we record your IP address and a device identifier: a random ID stored in your browser plus a one-way hash of basic browser settings (such as browser type, language, time zone and screen size). We store the device identifier only in hashed form, use these signals only to spot several accounts sharing the same network or device, and review any match by hand; shared networks such as offices, schools and mobile carriers are common, so a match alone does not lead to action. We keep these records for 12 months. Our legal basis is our legitimate interest in preventing fraud and abuse.

Participants

When you open a study link and agree to the consent text, your webcam video (no audio), still frames, automatically generated object boxes, the name you type to confirm consent, and timestamps are stored and made available to the researcher who invited you. The researcher decides how the data is used, as described in their consent text; for that data the researcher is the controller and we process it on their behalf.

Where data is stored

On Google Cloud / Firebase (United States, us-central1). Data is encrypted in transit and at rest.

Retention and deletion

Data is kept until the researcher deletes it or closes their account. Participants can ask the researcher, or us, to delete their recordings.

Your rights

Depending on where you live, you may have rights to access, correct, delete or export your data, and to object to processing. Email us to exercise them.

Cookies and storage

We do not use advertising or analytics cookies. We use essential browser storage (local storage / IndexedDB) to keep you signed in, to remember that you dismissed the cookie note, and to keep a random device ID used for fraud and abuse prevention (see above).

Security

Projects are private to their owner and enforced by server-side rules; participant links are single-person, expire and can be revoked.

Changes

We will update this page and the date above when this policy changes.